Meta has stated that it has fixed a security vulnerability in its AI-powered account recovery system after several high-profile Instagram accounts were reportedly compromised. The company said efforts to secure affected accounts are ongoing.
According to reports, attackers exploited a flaw in Instagram’s AI-driven support and account recovery system by manipulating the AI support tool and taking control of the password reset process. Following the discovery of the issue, Meta released a fix and initiated measures to enhance protection for affected users.
Security researchers ZachXBT and Dark Web Informer were the first to publicly disclose the issue. According to their findings, attackers discovered a way to manipulate Instagram’s AI-powered support assistant, a tool designed to help users regain access to accounts they have lost access to.
Reports said attackers first used VPN services to make their location appear similar to that of the targeted account. They then accessed the AI support chatbot through Instagram’s “Forgot Password” and “Get Support” options, where the attack process began.
According to reports, attackers used carefully crafted prompts to convince the AI chatbot that they were the legitimate owners of targeted accounts. In some cases, the chatbot reportedly allowed a new email address to be added during the account recovery process.
Once the new email address was accepted by the system, verification or password reset codes were sent to the attacker’s email instead of the legitimate user. Attackers then used those codes to set new passwords and obtain full control of the accounts.
Reports also claimed that, in some cases, attackers were able to persuade the chatbot to send password reset codes directly to their email addresses. However, the process was not successful in every attempt and often required repeated efforts.
The incident has also prompted discussion about the effectiveness of two-factor authentication (2FA). Some users said accounts with 2FA enabled remained protected from the attack, while some affected users claimed they lost access to their accounts despite having additional security measures activated.
It remains unclear to what extent the vulnerability affected Instagram’s security systems and authentication processes. Security experts said AI-based recovery systems require ber verification layers to help prevent similar incidents in the future.
After the issue became public, Meta confirmed that the security flaw had been addressed. A company spokesperson said the problem had been resolved and that teams were continuing to work on securing affected accounts.
Meta has not disclosed how many users were affected by the incident. Some users have also reported continuing difficulties in regaining access to their accounts even after the fix was released. The incident has renewed debate over the security and reliability of AI-based support systems.
